America's drivers licence breach is a national security disaster

🕵️ RESEARCH & DEEP DIVES

• SessionLatch adds session attestation to unmodified TLS services in confidential VMs
  Researchers present SessionLatch, a system that attests TLS sessions of confidential VMs without modifying applications, TLS stacks, or certificates.

  • Applies to confidential virtual machines running unmodified TLS services in trusted execution environments
  • Provides session attestation without changing applications, TLS implementations, or certificates, using trusted observation of the server's ephemeral public key plus standard TLS key confirmation
  • Attestation runs in the OS: a temporary latch holds client encrypted records while evidence exchange overlaps the TLS handshake, then removes itself after verification
  • Evaluated on real Hygon CSV attestation with Linux and Windows integration, cutting short-upload mean latency by 63.1%/23.0% versus TNG
  Sources 📎 Coverage: arxiv.org · 👁 via arXiv cs.CR

• Srsly Risky Biz: America's drivers licence breach is a national security disaster — Risky Business News

• Ninja Forms - Scheduled Exports through 3.0.3 - Authenticated (Subscriber+) Stored... — CVE ThreatInt

• BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload o... — CVE ThreatInt

• BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass ... — CVE ThreatInt

• Drag and Drop File Upload for Elementor Forms through 1.6.0 - Unauthenticated Arbi... — CVE ThreatInt

• AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents — arXiv cs.CR

• Compute-Bounded Security Assurance - Coverage, Verification, and Response under Resource Constraints — arXiv cs.CR

• In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning — arXiv cs.CR

• Cross User/App Network Attacks - Hijacking TCP Connections and DNS Cache Poisoning via a Malicious User/App (Extended Version) — arXiv cs.CR

• Encrypt What Matters: When Selective Homomorphic Inference Is Efficient — arXiv cs.CR

• LLMSec-AV: A Vulnerability Taxonomy and LLM-Driven Software Weakness Discovery Framework for Autonomous Vehicles — arXiv cs.CR

• X-amine509: Predicting the Practical Risk Level of Enterprise X.509 Certificates — arXiv cs.CR

• An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks — arXiv cs.CR

• DuplexJail: Safety Alignment Breaks Under Spoken Interruption in Full-Duplex Models — arXiv cs.CR

• FPGA Acceleration of Fully Homomorphic Encryption with Adaptive Key Switching — arXiv cs.CR

• Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic — arXiv cs.CR

• Audio Deepfake Detection Using Temporal Coherence Analysis — arXiv cs.CR

• An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems — arXiv cs.CR

• Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning — arXiv cs.CR

• When Ad Networks Misbehave: Understanding Risks of Semi-Drive-By Splash Ads — arXiv cs.CR

• Scalable Composition of Byzantine Agreements under Reorder Attacks — arXiv cs.CR

• PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA — arXiv cs.CR

• How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE — arXiv cs.CR

• CS-Guard: Benchmarking LLM Guardrails for Code Generation Security — arXiv cs.CR

• Claude AI Models Gained Unauthorized Access to Real Systems During Cybersecurity Tests — Cyber Security News

• Skullcandy Dime 3 earbuds will pair with strangers' devices automatically and there's no way to patch them — r/cybersecurity

• Huntress? — r/cybersecurity